CVE-2026-55064

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner’s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0.

• CWE-862

• https://github.com/go-vikunja/vikunja/commit/781ffac198548ae4f3d1febc613caed8e0e11d01
• https://github.com/go-vikunja/vikunja/pull/3239
• https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-44v6-7fxq-vgf4

Published

Aug 28, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55058Out-of-bounds read in Microsoft Office Excel allows an unaut…7.8
• CVE-2026-55059OpenEXR is the reference implementation and specification fo…6.1
• CVE-2026-5506The Wavr plugin for WordPress is vulnerable to Stored Cross-…6.4
• CVE-2026-55060GoCD is a continuous deliver server. From 13.1.0 until 26.1.…3.7
• CVE-2026-55061uniget is a universal installer and updater for (container) …1
• CVE-2026-55062uniget is a universal installer and updater for (container) …8.4
• CVE-2026-55065Vikunja is an open-source self-hosted task management platfo…8.1
• CVE-2026-55066Vikunja is an open-source self-hosted task management platfo…7.1
• CVE-2026-55067Vikunja is an open-source self-hosted task management platfo…5
• CVE-2026-55068free5GC is an open-source implementation of the 5G core netw…9.3
• CVE-2026-55069Kestra is an open-source, event-driven orchestration platfor…8.7
• CVE-2026-5507When restoring a session from cache, a pointer from the seri…4